Privacy Policy

Effective date: 1 June 2026 · Version 1.0 · Applies to: crm.todahsystems.com

    Summary: We collect only what is needed to run your CRM workspace. We do not sell your data. You can export or delete your data at any time by contacting us. This policy complies with the Nigeria Data Protection Regulation (NDPR) and the EU General Data Protection Regulation (GDPR).
  

1. Who We Are

Data Controller & Processor: Todah Systems Limited (trading as OppTrack CRM), Lagos, Nigeria.

Contact: privacy@todahsystems.com

Data Protection Officer: [DPO Name] — dpo@todahsystems.com

We operate OppTrack CRM, a cloud-based customer relationship management platform available at crm.todahsystems.com.

2. Scope

This policy applies to:

Account holders (businesses that sign up for a workspace — "Tenants")
End users (employees and team members added by Tenants)
Contacts and data subjects whose information Tenants enter into the platform

As a B2B SaaS product, Tenants are the Data Controllers of the personal data they enter about their customers. Todah Systems acts as the Data Processor for that data. For Tenant account data, we act as Data Controller.

3. Data We Collect

3.1 Account & Registration Data

Company name, full name, email address, workspace slug
Billing plan selection
IP address and timestamp at signup
Record of consent to these Terms (timestamp + version)

3.2 Data Entered by Tenants (CRM Data)

Tenants enter their own business data into the platform, which may include personal data about their clients and contacts:

Contact names, email addresses, phone numbers, company affiliations
Sales pipeline, lead, and opportunity records
Notes, activity logs, and documents
Measurements (for fashion industry tenants)
Student records (for education industry tenants)
Financial information: quotes, invoices, payment status

3.3 Technical & Usage Data

Login timestamps and IP addresses (retained in audit log)
Browser session cookie (necessary for authentication — see Section 7)
Server error logs

4. Lawful Basis for Processing

Data Category	Lawful Basis (GDPR Art. 6)	NDPR Basis
Account registration data	Contract (Art. 6(1)(b)) — necessary to provide the service	Contractual necessity
Billing and plan data	Contract (Art. 6(1)(b))	Contractual necessity
CRM data entered by Tenants	Legitimate interests of the Tenant (Art. 6(1)(f)); consent where required	Legitimate interest / consent
Security & audit logs	Legitimate interests (Art. 6(1)(f)) — fraud prevention, security	Legitimate interest
Session cookies	Strictly necessary — consent exception applies	Strictly necessary

5. How We Use Your Data

To create and manage your workspace
To authenticate users and maintain session security
To send transactional emails (welcome email, password reset, reminders)
To enforce plan limits and billing
To detect and prevent security threats and abuse
To comply with legal obligations

We do not use your CRM data for advertising, profiling, or sale to third parties.

6. Sub-Processors and Third Parties

We use the following sub-processors. Each is bound by a Data Processing Agreement:

Sub-Processor	Purpose	Data Transferred	Location
DigitalOcean, LLC	Cloud hosting and database storage	All platform data	United States / EU (configurable)
Brevo (Sendinblue)	Transactional email delivery	Email address, name, message content	European Union

We do not share your data with any other third party except where required by law.

7. Cookies

We use one strictly necessary cookie:

Cookie Name	Purpose	Duration	Type
`PHPSESSID`	Session authentication — keeps you logged in	Browser session (deleted on close)	Strictly necessary

We do not use tracking cookies, advertising cookies, or analytics cookies. No third-party cookies are set by our platform.

8. Data Retention

Data Type	Retention Period
Active tenant workspace data	For the duration of the subscription + 30 days after cancellation
Audit and activity logs	2 years
Login attempt records	24 hours
Password reset tokens	1 hour (auto-expired)
Erasure request records	5 years (legal compliance)

9. Your Rights

Under GDPR and NDPR, you have the following rights:

Right of Access (Art. 15 GDPR / NDPR 3.1(c)): Request a copy of your personal data.
Right to Rectification (Art. 16 GDPR): Correct inaccurate data — most data is editable directly in the CRM.
Right to Erasure (Art. 17 GDPR / NDPR 3.1(d)): Request deletion of your workspace and all associated data. We will complete erasure within 30 days.
Right to Restrict Processing (Art. 18 GDPR): Request restriction while a dispute is resolved.
Right to Data Portability (Art. 20 GDPR): Receive your data in a structured, machine-readable format (JSON/CSV export).
Right to Object (Art. 21 GDPR): Object to processing based on legitimate interests.

To exercise any of these rights, contact us at privacy@todahsystems.com. We will respond within 30 days.

10. Cross-Border Data Transfers

Data is stored on DigitalOcean servers. For EU users, you may request data storage on EU-region servers. Transfers outside the EEA are covered by Standard Contractual Clauses (SCCs) as per GDPR Chapter V.

For Nigerian users: data stored outside Nigeria is governed by NDPR provisions on cross-border transfers. We take appropriate steps to ensure equivalent protection.

11. Security

We implement the following technical measures:

TLS encryption in transit (HTTPS enforced)
Bcrypt password hashing (cost factor 12)
Per-tenant database isolation — no shared tables between tenants
CSRF token protection on all state-changing requests
Session fixation protection (ID regeneration on login)
IP-based brute force lockout (5 attempts / 15 minutes)
Audit logging of all significant actions

12. Data Breach Notification

In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware (GDPR Art. 33) and notify affected data subjects without undue delay where there is a high risk to their rights and freedoms.

To report a security vulnerability: security@todahsystems.com

13. Children's Data

OppTrack CRM is a business product intended for use by organisations. We do not knowingly collect personal data from children under 13. If you believe a child's data has been submitted, contact us immediately.

14. Changes to This Policy

We may update this policy. Material changes will be notified by email to account holders at least 14 days before taking effect. The version number and effective date at the top of this page always reflect the current policy.

15. Complaints

You have the right to lodge a complaint with your local data protection authority:

Nigeria: Nigeria Data Protection Commission (NDPC) — ndpc.gov.ng
EU: Your national data protection authority (see edpb.europa.eu)